Public dav endpoint v2

[skjnldsv]

Fix #19700

Implements a new v2 endpoint which also allows GET

$ curl -k https://dev.domain.com/public.php/dav/files/Y9Hc4SPqg564gid -X PROPFIND
$ curl -k https://dev.domain.com/public.php/dav/files/Y9Hc4SPqg564gid/video.mp4 -X PROPFIND

Access a file directly

$ curl -k https://dev.domain.com/public.php/dav/files/Y9Hc4SPqg564gid/video.mp4 -X GET

If password-protected

$ curl -k -u 'anonymous:password' https://dev.domain.com/public.php/dav/files/Y9Hc4SPqg564gid

• GET access to direct files
• Bruteforce protected
• Once authenticated (with share password), no need to send basic auth again

@nextcloud/server-backend any thoughts?

[PVince81]

@skjnldsv what happens if you still send basic auth for "https://dev.domain.com/public.php/dav/files/Y9Hc4SPqg564gid" ? will it then try to look for a folder "Y9Hc4SPqg564gid" inside the share ? just to double check that there is no conflict/confusion happening between both approaches

[skjnldsv]

@skjnldsv what happens if you still send basic auth for "dev.domain.com/public.php/dav/files/Y9Hc4SPqg564gid" ? will it then try to look for a folder "Y9Hc4SPqg564gid" inside the share ? just to double check that there is no conflict/confusion happening between both approaches

It will ignore the username.
Basic auth is only used to authenticate on protected shares now

addressed

[come-nc]

A bit too much legacy calls and new to my liking, but otherwise seems sane.

[provokateurin]

OpenAPI is good (no breaking changes because it only fixes things that were wrong before).

[nickvergessen]

Just a question to help me understand, the file still exists and public.php/webdav also still prints:

This is the WebDAV interface. It can only be accessed by WebDAV clients such as the Nextcloud desktop sync client.

But where is it registered now?

[nickvergessen]

Ah, hardcoded in public.php now

[skjnldsv]

Similarly as how remote.php is doing it :)

I tried to get them closer together now